Sigma detection rules, expert-reviewed

Malicious Cryptocurrency Miner Execution (via process_creation)

This rule detects command lines carrying cryptomining indicators such as stratum pool URLs, --donate-level or known miner names, a resource-hijacking impact technique that runs coin miners on compromised Linux hosts. Cryptomining is tracked in the Red Canary Threat Detection Report. Detecting these arguments surfaces unauthorized use of compute resources.

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

This rule detects rundll32.exe executing a named or ordinal export from a DLL located in AppData, ProgramData or Temp, the execution behavior IcedID and Bumblebee use to run a downloaded loader. Rundll32 export execution from user-writable paths is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loaders running under a signed binary.

Renamed User Account Creation Disguised in a Computer Account (via security)

This rule detects creates a user account that fakes a computer account.

Malicious Modification of a User Account SPN to Enable Kerberoast Attack (via security)

This rule detects update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.

Malicious Account Set with Kerberos DES Encryption Activated - Weakness Introduction (via security)

This rule detects set an account with DES Kerberos encryption to perform ticket brutforce.

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious Account Set with Kerberos Pre-authentication Not Required - AS-REP Roasting (via security)

This rule detects set an account with Kerberos pre-authentication not required to perform offline brutforce. Account with this status can be checked with the following command > "Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol".

PowerShell Proxy Execution via SyncAppvPublishingServer (via process_creation)

This rule detects SyncAppvPublishingServer being used to smuggle a PowerShell command through its argument, a signed-binary proxy technique that runs script code while masking the parent as a trusted App-V component. SyncAppvPublishingServer abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting this pattern surfaces script execution hidden behind a signed binary.

SocGholish Fake Browser Update Script Execution (via process_creation)

This rule detects the Windows Script Host running a JavaScript file whose name impersonates a browser update, the delivery-and-execution behavior behind SocGholish drive-by fake-update lures. SocGholish is a prevalent initial-access threat profiled in the Red Canary Threat Detection Report that uses malicious JScript to stage follow-on payloads. Detecting the fake-update script surfaces the intrusion at the execution stage before hands-on-keyboard activity.

Malicious Sticky Key File Created from CMD Copy (via file_event)

This rule detects replace the original sethc.exe file by cmd.exe.

Obfuscated Paste-and-Run Execution From the Windows Run Dialog (via process_creation)

This rule detects explorer.exe directly spawning PowerShell, mshta or curl with a remote URL or encoded payload, the signature of a ClickFix/paste-and-run lure that tricks a user into pasting an attacker command into the Run dialog. Paste-and-run social engineering is one of the fastest-rising initial-access techniques in the Red Canary Threat Detection Report, delivering stealers and loaders. Detecting interpreter children of explorer carrying remote or encoded commands surfaces the intrusion at first execution.

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious Shell Spawned by Mshta Delivery (via process_creation)

This rule detects mshta.exe spawning PowerShell, cmd or another script host, the delivery-to-execution handoff seen in ClickFix, Lumma Stealer and SmartApeSG fake-update chains. Mshta launching a shell is an execution technique tracked in the Red Canary Threat Detection Report. Detecting this parent-child pair surfaces HTA-driven payload execution.

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

This rule detects enumerate potential existing SQL users, resulting in failed logins with unexisting or invalid accounts.

DSRM Password Changed - Native (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.